Do not accept CSS-wide keywords for descriptors

third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSPropertyParser.h"
 
 #include "core/StylePropertyShorthand.h"
 #include "core/css/CSSBasicShapeValues.h"
 #include "core/css/CSSBorderImage.h"
 #include "core/css/CSSContentDistributionValue.h"
@@ skipping 287 matching lines @@
         value = cssValuePool().createExplicitInitialValue();
     else if (id == CSSValueInherit)
         value = cssValuePool().createInheritedValue();
     else if (id == CSSValueUnset)
         value = cssValuePool().createUnsetValue();
     else
         return false;
 
     CSSPropertyID property = resolveCSSPropertyID(unresolvedProperty);
     const StylePropertyShorthand& shorthand = shorthandForProperty(property);
-    if (!shorthand.length())
+    if (!shorthand.length()) {
+        if (CSSPropertyMetadata::isDescriptor(property))

[Timothy Loh, 2016/05/19 05:44:42]

I think it's better to be at the very top of parseValueStart, so it's clear that
these non-properties are never successfully parsed.

[rwlbuis, 2016/05/20 00:51:11]

Same as before, done for efficiency, can move if you want. I was not sure if an
UNLIKELY would help either.

+            return false;
         addProperty(property, CSSPropertyInvalid, value, important);
-    else
+    } else {
         addExpandedPropertyForValue(property, value, important);
+    }
     m_range = rangeCopy;
     return true;
 }
 
 static CSSValueList* consumeTransformOrigin(CSSParserTokenRange& range, CSSParserMode cssParserMode, UnitlessQuirk unitless)
 {
     CSSValue* resultX = nullptr;
     CSSValue* resultY = nullptr;
     if (consumeOneOrTwoValuedPosition(range, cssParserMode, unitless, resultX, resultY)) {
         CSSValueList* list = CSSValueList::createSpaceSeparated();
@@ skipping 4709 matching lines @@
     case CSSPropertyGridTemplate:
         return consumeGridTemplateShorthand(CSSPropertyGridTemplate, important);
     case CSSPropertyGrid:
         return consumeGridShorthand(important);
     default:
         return false;
     }
 }
 
 } // namespace blink